You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/machine-learning/how-to-custom-dns.md
+51-6Lines changed: 51 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -41,13 +41,14 @@ When using an Azure Machine Learning workspace with a private endpoint, there ar
41
41
- An Azure Virtual Network that uses [your own DNS server](../virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances.md#name-resolution-that-uses-your-own-dns-server).
42
42
43
43
:::moniker range="azureml-api-2"
44
-
- An Azure Machine Learning workspace with a private endpoint. For more information, see [Create an Azure Machine Learning workspace](how-to-manage-workspace.md).
44
+
- An Azure Machine Learning workspace with a private endpoint, including hub workspaces such as those used by Azure AI Studio. For more information, see [Create an Azure Machine Learning workspace](how-to-manage-workspace.md).
45
+
46
+
- If your workspace resources are secured with an __Azure Virtual network__, familiarity with the [Network isolation during training & inference](./how-to-network-security-overview.md) article.
45
47
:::moniker-end
46
48
:::moniker range="azureml-api-1"
47
49
- An Azure Machine Learning workspace with a private endpoint. For more information, see [Create an Azure Machine Learning workspace](./v1/how-to-manage-workspace.md).
48
-
:::moniker-end
49
-
50
50
- Familiarity with using [Network isolation during training & inference](./how-to-network-security-overview.md).
51
+
:::moniker-end
51
52
52
53
- Familiarity with [Azure Private Endpoint DNS zone configuration](../private-link/private-endpoint-dns.md)
53
54
@@ -71,6 +72,9 @@ Another option is to modify the `hosts` file on the client that is connecting to
71
72
72
73
Access to a given Azure Machine Learning workspace via Private Link is done by communicating with the following Fully Qualified Domains (called the workspace FQDNs) listed below:
73
74
75
+
> [!IMPORTANT]
76
+
> If you are using a hub workspace (including Azure AI Studio hub), then you will have addtional entries for each project workspace created from the hub.
77
+
74
78
**Azure Public regions**:
75
79
-```<per-workspace globally-unique identifier>.workspace.<region the workspace was created in>.api.azureml.ms```
76
80
-```<per-workspace globally-unique identifier>.workspace.<region the workspace was created in>.cert.api.azureml.ms```
@@ -79,6 +83,12 @@ Access to a given Azure Machine Learning workspace via Private Link is done by c
-```<managed online endpoint name>.<per-workspace globally-unique identifier>.inference.<region>.privatelink.api.ml.azure.us``` - Used by managed online endpoints
114
136
115
-
The FQDNs resolve to the IP addresses of the Azure Machine Learning workspace in that region. However, resolution of the workspace Private Link FQDNs can be overridden by using a custom DNS server hosted in the virtual network. For an example of this architecture, see the [custom DNS server hosted in a vnet](#example-custom-dns-server-hosted-in-vnet) example.
137
+
The FQDNs resolve to the IP addresses of the Azure Machine Learning workspace in that region. However, resolution of the workspace Private Link FQDNs can be overridden by using a custom DNS server hosted in the virtual network. For an example of this architecture, see the [custom DNS server hosted in a vnet](#example-custom-dns-server-hosted-in-vnet) example. For hub and project workspaces, the FQDNs of all project workspaces resolve to the IP address of the hub workspace.
@@ -140,6 +162,9 @@ The following list contains the fully qualified domain names (FQDNs) used by you
140
162
*`<instance-name>-22.<region>.instances.azureml.ms` - Only used by the `az ml compute connect-ssh` command to connect to computes in a managed virtual network. Not needed if you are not using a managed network or SSH connections.
141
163
*`<managed online endpoint name>.<region>.inference.ml.azure.com` - Used by managed online endpoints
142
164
165
+
> [!TIP]
166
+
> If you are using hub and project workspaces, each project workspace has its own set of additional FQDNs. For more information, see the [workspace DNS resolution](#workspace-dns-resolution-path) section.
167
+
143
168
#### Microsoft Azure operated by 21Vianet region
144
169
145
170
The following FQDNs are for Microsoft Azure operated by 21Vianet regions:
@@ -158,6 +183,9 @@ The following FQDNs are for Microsoft Azure operated by 21Vianet regions:
158
183
*`<instance-name>-22.<region>.instances.azureml.cn` - Only used by the `az ml compute connect-ssh` command to connect to computes in a managed virtual network. Not needed if you are not using a managed network or SSH connections.
159
184
*`<managed online endpoint name>.<region>.inference.ml.azure.cn` - Used by managed online endpoints
160
185
186
+
> [!TIP]
187
+
> If you are using hub and project workspaces, each project workspace has its own set of additional FQDNs. For more information, see the [workspace DNS resolution](#workspace-dns-resolution-path) section.
188
+
161
189
#### Azure US Government
162
190
163
191
The following FQDNs are for Azure US Government regions:
@@ -175,6 +203,9 @@ The following FQDNs are for Azure US Government regions:
175
203
176
204
*`<managed online endpoint name>.<region>.inference.ml.azure.us` - Used by managed online endpoints
177
205
206
+
> [!TIP]
207
+
> If you are using hub and project workspaces, each project workspace has its own set of additional FQDNs. For more information, see the [workspace DNS resolution](#workspace-dns-resolution-path) section.
208
+
178
209
### Find the IP addresses
179
210
180
211
To find the internal IP addresses for the FQDNs in the VNet, use one of the following methods:
@@ -190,7 +221,7 @@ To find the internal IP addresses for the FQDNs in the VNet, use one of the foll
190
221
az network private-endpoint show --name <endpoint> --resource-group <resource-group> --query 'networkInterfaces[*].id' --output table
191
222
```
192
223
193
-
1. To get the IP address and FQDN information, use the following command. Replace `<resource-id>` with the ID from the previous step:
224
+
1. To get the IP address and FQDN information for the workspace or hub workspace, use the following command. Replace `<resource-id>` with the ID from the previous step:
194
225
195
226
```azurecli
196
227
az network nic show --ids <resource-id> --query 'ipConfigurations[*].{IPAddress: privateIpAddress, FQDNs: privateLinkConnectionProperties.fqdns}'
@@ -221,6 +252,20 @@ To find the internal IP addresses for the FQDNs in the VNet, use one of the foll
221
252
}
222
253
]
223
254
```
255
+
256
+
1. If you're using a hub workspace, use the following steps _for each_ project workspace that was created from the hub:
257
+
258
+
1. To get the project workspace ID, use the following command:
259
+
260
+
```azurecli
261
+
az ml workspace show --name <project-workspace-name> --resource-group <resource-group> --query 'discovery_url'
262
+
```
263
+
264
+
The value returned will follow the format `https://<project-workspace-id>.workspace.<region>.api.azureml.ms/mlflow/<version>/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.MachineLearningServices/workspaces/<project-workspace-name>`.
265
+
266
+
1. Take the FQDNs returned from the hub workspace that end in `workspace.<region>.api.azureml.ms` and `workspace.<region>.cert.api.azureml.ms`. Replace the GUID value at the beginning of these FQDNs with the project workspace ID. These FQDNs are in addition to the hub workspace FQDNs.
267
+
1. Take the FQDN returned from the hub workspace that follows the format in `<workspace-name>-<region>-<GUID>.<region>.notebooks.azure.net`. Replace the GUID value with the project workspace ID. Replace the hub workspace name with the project workspace name. You may need to truncate the workspace name to keep this entry at 63 characters or less. This FQDN is in addition to the hub workspace FQDN.
![prmerger-automator[bot]](https://avatars.githubusercontent.com/u/22479449?v=4&size=40){kind=avatar}
0 commit comments